The historic IT outage on July 19 highlighted key threats to global systems from interdependency and concentration. With the launch of ether-backed exchange-traded funds (ETFs) on July 23, investors are assessing the prospects of the Ethereum network. S&P Global Ratings believes that Ethereum's decentralization supports its operational resilience, but that it is critical to understand its concentration risks and how these may evolve.
What's Happening
The July 19 global IT outage highlighted single points of failure in existing systems. Ethereum and other major public blockchains were not affected this time. As more financial market activity moves into the Ethereum ecosystem, understanding and monitoring concentration risks will be key.
Why It Matters
Ethereum may increasingly act as a settlement layer for financial markets. In recent months, we have seen issuance of digital bonds on public blockchains, as well as Blackrock's issuance of the BUIDL fund on Ethereum. These are significant innovations as public blockchains such as Ethereum play a part in solving the interoperability challenges that so far inhibit blockchain adoption. To date, digital bond issuers have primarily used private permissioned blockchains, each of these being a "walled garden" set up by a specific institution. This does not support a liquid secondary market for these bonds to trade and so hinders wider adoption.
Understanding and monitoring Ethereum's concentration risks is key. Ethereum requires the consensus of two-thirds of the network's validators to finalize each new block added to the chain. If more than one-third of the validators are offline at once, blocks cannot be finalized. It's therefore crucial to monitor any concentration risk that could cause this to happen. As noted in the chart above:
- No single entity controls one-third of validator nodes. The largest staking concentration (29%) is through the Lido decentralized staking protocol: these nodes share an exposure to Lido's smart contract risk, but are operated by several different operators.
- Diversification of client software packages run by validators (consensus and execution clients) mitigates the risk of a network outage resulting from any bug in this software. This is a strength over most public blockchains, which currently use a single client. Client concentration risk persists, however, as seen in the network's only delayed finality event in May 2023.
- Validators are not concentrated through a single cloud provider: the largest exposure hosted by a single provider is only 17% of validators.
(For more information, see "What Can You Trust In A Trustless System: Public Blockchains For Financial Applications," Oct. 11, 2023)
What's Next
Regulatory developments may smooth the path for increased competition in U.S. crypto custody markets. Specifically, the Security and Exchange Commission's (SEC) rule "Special Accounting Bulletin (SAB) 121" currently requires entities holding crypto assets in custody for their clients to report these assets on their balance sheet with a corresponding liability. This makes it prohibitively expensive for U.S. banks to provide custody for crypto assets. Earlier this year, the House and Senate voted to repeal SAB 121, but this was vetoed by President Biden and the rule remains in place.
As a result of SAB 121, there is little competition for crypto custody services in the U.S. Indeed, the custody of bitcoin held in ETFs is highly concentrated with a small number of providers. We expect this to be similar for ether ETFs upon their launch. Initially, these ETFs will not stake the underlying ether, therefore concentration among custody providers will not affect concentration risks in the network itself. This may eventually change: some applications initially contemplated staking but removed this prior to approval, and staking products exist in other countries. A competitive market for staking custodians at that point would help to mitigate staking concentration risks (see chart and related research).
Related Research
- CrowdStrike Update Issues Highlight The Perils To Global IT Systems From Interdependency And Concentration, July 19, 2024
- U.S. Ether ETFs Could Exacerbate Concentration Risk, Feb. 20, 2024
- What Can You Trust In A Trustless System: Public Blockchains For Financial Applications, Oct. 11, 2023
This report does not constitute a rating action.
| Primary Credit Analyst: | Andrew O'Neill, CFA, London + 44 20 7176 3578; andrew.oneill@spglobal.com |
| Secondary Contact: | Lapo Guadagnuolo, London + 44 20 7176 3507; lapo.guadagnuolo@spglobal.com |
No content (including ratings, credit-related analyses and data, valuations, model, software, or other application or output therefrom) or any part thereof (Content) may be modified, reverse engineered, reproduced, or distributed in any form by any means, or stored in a database or retrieval system, without the prior written permission of Standard & Poor’s Financial Services LLC or its affiliates (collectively, S&P). The Content shall not be used for any unlawful or unauthorized purposes. S&P and any third-party providers, as well as their directors, officers, shareholders, employees, or agents (collectively S&P Parties) do not guarantee the accuracy, completeness, timeliness, or availability of the Content. S&P Parties are not responsible for any errors or omissions (negligent or otherwise), regardless of the cause, for the results obtained from the use of the Content, or for the security or maintenance of any data input by the user. The Content is provided on an “as is” basis. S&P PARTIES DISCLAIM ANY AND ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE, FREEDOM FROM BUGS, SOFTWARE ERRORS OR DEFECTS, THAT THE CONTENT’S FUNCTIONING WILL BE UNINTERRUPTED, OR THAT THE CONTENT WILL OPERATE WITH ANY SOFTWARE OR HARDWARE CONFIGURATION. In no event shall S&P Parties be liable to any party for any direct, indirect, incidental, exemplary, compensatory, punitive, special or consequential damages, costs, expenses, legal fees, or losses (including, without limitation, lost income or lost profits and opportunity costs or losses caused by negligence) in connection with any use of the Content even if advised of the possibility of such damages.
Credit-related and other analyses, including ratings, and statements in the Content are statements of opinion as of the date they are expressed and not statements of fact. S&P’s opinions, analyses, and rating acknowledgment decisions (described below) are not recommendations to purchase, hold, or sell any securities or to make any investment decisions, and do not address the suitability of any security. S&P assumes no obligation to update the Content following publication in any form or format. The Content should not be relied on and is not a substitute for the skill, judgment, and experience of the user, its management, employees, advisors, and/or clients when making investment and other business decisions. S&P does not act as a fiduciary or an investment advisor except where registered as such. While S&P has obtained information from sources it believes to be reliable, S&P does not perform an audit and undertakes no duty of due diligence or independent verification of any information it receives. Rating-related publications may be published for a variety of reasons that are not necessarily dependent on action by rating committees, including, but not limited to, the publication of a periodic update on a credit rating and related analyses.
To the extent that regulatory authorities allow a rating agency to acknowledge in one jurisdiction a rating issued in another jurisdiction for certain regulatory purposes, S&P reserves the right to assign, withdraw, or suspend such acknowledgement at any time and in its sole discretion. S&P Parties disclaim any duty whatsoever arising out of the assignment, withdrawal, or suspension of an acknowledgment as well as any liability for any damage alleged to have been suffered on account thereof.
S&P keeps certain activities of its business units separate from each other in order to preserve the independence and objectivity of their respective activities. As a result, certain business units of S&P may have information that is not available to other S&P business units. S&P has established policies and procedures to maintain the confidentiality of certain nonpublic information received in connection with each analytical process.
S&P may receive compensation for its ratings and certain analyses, normally from issuers or underwriters of securities or from obligors. S&P reserves the right to disseminate its opinions and analyses. S&P's public ratings and analyses are made available on its Web sites, www.spglobal.com/ratings (free of charge), and www.ratingsdirect.com (subscription), and may be distributed through other means, including via S&P publications and third-party redistributors. Additional information about our ratings fees is available at www.spglobal.com/usratingsfees.